Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon access scanning

Eric Paris
2008-08-05T20:56:56Z

On Tue, 2008-08-05 at 13:38 -0700, Arjan van de Ven wrote:
> and again please explain how you
> deal with write-to-mmap-after-close)

http://marc.info/?l=linux-security-module&m=121796172212429&w=2

Write after close will invalidate the close time caching decision, but
will still get caught on the next open....

-Eric